Log in Start free

Vulnerability · Published Aug 8, 2025 · Assigned by mitre

CVE-2025-55188

Low 3.6

In plain English

A low-severity security flaw in 7-Zip from 7-Zip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)1.0%top 37.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:127zip22.01+really25.01+dfsg-0+deb12u1DEBIAN-CVE-2025-55188
Debian:137zip25.01+dfsg-1~deb13u1DEBIAN-CVE-2025-55188
Debian:147zip25.01+dfsg-1DEBIAN-CVE-2025-55188
Debian:12p7zip16.02+really25.01+dfsg-0+deb12u1DEBIAN-CVE-2025-55188
Debian:13p7zip16.02+transitional.1DEBIAN-CVE-2025-55188
Ubuntu:25.107zipno fix listedUBUNTU-CVE-2025-55188
Ubuntu:22.04:LTSp7zipno fix listedUBUNTU-CVE-2025-55188

Affected products (as reported)

VendorProductVersions
7-Zip 7-Zip 0 – before 25.01

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

References